Deep-TEMPEST Attack Reads PC Screens via HDMI Cables Using AI, No Malware Needed

Researchers discovered a new type of cybersecurity risk: Deep-TEMPEST. This attack can exfiltrate all data shown on a PC screen with no software installation and without accessing the local network. The risk is significant because Deep-TEMPEST subverts standard security defenses based on concepts like air-gapping or endpoint security that protect sensitive data. Individuals working with confidential data now have to be aware of the risk of physical electromagnetic leaks as a potential threat vector in addition to cyber attacks.

AI decodes electromagnetic radiation from HDMI cables to reconstruct displays

Deep-TEMPEST works by taking advantage of electromagnetic radiation naturally emitted by standard HDMI cables that are effectively functioning as unintended antennae for video data. The researchers developed a technique that leverages AI and deep learning models to decipher these radio signals from the fuzz. The analysis interprets and translates the electromagnetic fuzz that is part of modern digital display standards and renders it into intelligible screen captures.

The Deep-TEMPEST attack can be executed without physical access to the machine or prior knowledge of the OS in use. The use of AI is essential to be able to decrypt the complex electromagnetic interference patterns that arise from digital signal transmission. This makes it possible to skip the usual use of malware agents or network sniffing utilities to exfiltrate data remotely.

To mitigate this side channel attack, changes need to be made on the hardware level of the display connection. Heavy shielding on the cable to prevent electromagnetic radiation is one of the most effective counter-measures to the risk. Inserting ferrite chokes into the cables or operating the system from within TEMPEST certified enclosures can also block the radiation leveraged by the attack.